That or it'll be a cat and mouse chase like cname cloaking/proxying rendering those harder to statically detect.